Cyber Security Academy · Lesson

Persistence and Lateral Movement

Staying in and moving across accounts.

Persistence and Lateral Movement is a free Cyber Security Academy lesson on CoddyKit — lesson 4 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Cyber Security Academy learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.

Staying In and Moving Across

After escalation, attackers want durable access and reach across the environment. In the cloud, persistence and lateral movement use identity and configuration, not implants on disk.

Persistence: survive credential rotation and detection.
Lateral movement: pivot across accounts, roles, and services.

Identity-Based Persistence

The simplest persistence is creating new credentials you control.

Create an extra access key on a privileged user.
Add a login profile (console password) to a service account.
Register an additional credential on a service principal (Azure) or a service-account key (GCP).

# AWS: add a second access key to a target user
aws iam create-access-key --user-name admin

# GCP: mint a long-lived key for a service account
gcloud iam service-accounts keys create k.json --iam-account priv@proj.iam.gserviceaccount.com

Backdooring Trust and Policies

Subtler persistence modifies who is trusted, blending into normal config.

Add your principal to a role's trust policy.
Insert an allow statement into a widely-used managed policy.
Create a new role that trusts an external attacker-controlled account.

These survive key rotation because they are structural, not credential-based.

Resource-Based Backdoors

Resource policies can grant cross-account access without changing IAM users.

Add an external account to an S3 bucket policy or KMS key policy.
Subscribe an external endpoint to an SNS topic or event bus.
Share a snapshot/AMI with an attacker account.

# Share an EBS snapshot with an external account
aws ec2 modify-snapshot-attribute --snapshot-id snap-abc \
  --attribute createVolumePermission --operation-type add --user-ids 999999999999

Compute and Function Persistence

Workloads themselves can host persistence.

A Lambda triggered on a schedule (EventBridge) re-establishes access.
User-data scripts run on instance boot.
A malicious layer or modified container image persists across redeploys.

# Schedule a Lambda to run every hour as a backdoor
aws events put-rule --schedule-expression 'rate(1 hour)' --name keepalive

Lateral Movement via Roles

Role assumption is the primary lateral pathway. From one identity you chain into others.

Assume a cross-account role to enter another account.
Use PassRole to operate as a service role with different reach.
Role chaining: assume role A, which can assume role B, and so on.

# Chain into another account
aws sts assume-role --role-arn arn:aws:iam::222:role/Deploy --role-session-name pivot

Lateral Movement via Compute

Compromised VMs and containers enable movement into the data plane.

Use SSM / Run Command to execute on instances without SSH.
Read instance metadata for fresh role credentials on each host.
Pivot through peered VPCs and shared subnets.

# Run a command on instances via SSM (no inbound port needed)
aws ssm send-command --document-name AWS-RunShellScript \
  --targets Key=tag:env,Values=prod --parameters 'commands=["id"]'

Data Exfiltration Paths

Movement often serves data theft. Cloud-native exfil channels are easy to overlook.

Copy objects to an attacker-owned bucket via bucket policy.
Create a public snapshot and import it elsewhere.
Replicate a database or stream logs to an external sink.

Evading Detection

Attackers reduce telemetry to extend dwell time.

Stop or filter CloudTrail / Activity Log delivery.
Operate within a single region to limit cross-region alerts.
Use existing roles and named sessions that resemble legitimate automation.

Tampering with logging is itself a strong detection opportunity for defenders.

Detecting and Defending

Blue teams counter cloud persistence with monitoring and guardrails.

Alert on new access keys, trust-policy edits, and resource-policy changes granting external accounts.
Detect CloudTrail being stopped or losing global service events.
Use SCPs to deny cross-account sharing and log tampering org-wide.
Prefer short-lived credentials and continuously rotate; expire unused keys.

Cleaning Up After Testing

Persistence artifacts are dangerous to leave behind. During authorized testing, inventory every backdoor you create (keys, roles, trust edits, scheduled functions, shared snapshots) and remove them all at engagement end.

Report each persistence technique with the precise revert steps so defenders can verify removal.

Quick Check

Confirm your persistence and movement knowledge.

Recap

You learned cloud persistence and lateral movement.

Persistence uses new credentials, trust/policy backdoors, and resource policies.
Lateral movement chains role assumption and compute access (SSM, metadata).
Attackers tamper with logging to extend dwell time.
SCPs, short-lived creds, and config-change alerting are the defenses.

This completes the Cloud Penetration Testing course.

Frequently asked questions

Is the “Persistence and Lateral Movement” lesson free?

Yes — the full text of “Persistence and Lateral Movement” is free to read here on the web, and the Cyber Security Academy course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Cyber Security Academy course, upgrade to CoddyKit PRO.

What will I learn in “Persistence and Lateral Movement”?

Staying in and moving across accounts. You practise Cyber Security Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.

Do I need any experience to start Cyber Security Academy?

No prior experience is required. Cyber Security Academy on CoddyKit is structured for beginners through advanced learners; this is — lesson 4 of 4, so you can start here or from the beginning and move at your own pace.

How long does the “Persistence and Lateral Movement” lesson take?

Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.

Can I write and run code in this Cyber Security Academy lesson?

Yes. Every Cyber Security Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.

All lessons in this course

← Back to Cyber Security Academy